ComboFix 08-11-23.02 - Eddy 2008-11-24 20:21:11.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1178 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\Computer Fix\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Eddy\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML c:\windows\default.htm c:\windows\system32\smwin32.dll . ((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 ))))))))))))))))))))))))))))))) . 2008-11-20 21:53 . 2008-11-20 22:02 d-------- c:\program files\Norton 360 2008-11-20 21:50 . 2008-11-20 21:54 d-------- c:\program files\Symantec 2008-11-20 21:50 . 2008-11-21 12:48 d-------- c:\documents and settings\All Users\Application Data\Symantec 2008-11-20 21:50 . 2008-11-20 21:54 123,952 --a------ c:\windows\system32\drivers\SYMEVENT.SYS 2008-11-20 21:50 . 2008-11-20 21:54 60,800 --a------ c:\windows\system32\S32EVNT1.DLL 2008-11-19 23:29 . 2008-11-19 23:29 d-------- c:\documents and settings\Any User\Application Data\Symantec 2008-11-19 22:31 . 2008-11-19 22:31 d-------- c:\program files\Windows Sidebar 2008-11-19 22:29 . 2008-11-20 21:54 10,563 --a------ c:\windows\system32\drivers\SYMEVENT.CAT 2008-11-19 22:29 . 2008-11-20 21:54 805 --a------ c:\windows\system32\drivers\SYMEVENT.INF 2008-11-19 22:20 . 2008-11-20 22:07 d-------- c:\documents and settings\Eddy\Application Data\Symantec 2008-11-19 21:29 . 2008-11-19 21:29 d-------- c:\program files\Trend Micro 2008-11-15 22:19 . 2008-11-22 20:12 d-------- c:\documents and settings\Any User\Application Data\AdobeUM 2008-11-12 19:05 . 2008-11-12 19:05 d-------- c:\program files\Common Files\SWF Studio 2008-11-12 19:02 . 2007-07-30 14:44 3,518,464 --a------ c:\windows\system32\cdintf300.dll 2008-11-12 19:02 . 2007-06-28 14:09 1,843,200 --a------ c:\windows\system32\acXMLParser.dll 2008-11-12 18:59 . 2008-11-12 18:59 d-------- c:\program files\Intuit 2008-11-12 18:59 . 2008-11-12 19:00 d-------- c:\program files\Common Files\Intuit 2008-11-12 18:59 . 2008-11-13 03:06 d-------- c:\documents and settings\All Users\Application Data\Intuit 2008-11-12 18:58 . 2008-11-12 19:19 d-------- c:\documents and settings\All Users\Application Data\SQL Anywhere 10 2008-11-12 18:58 . 2008-11-12 18:58 d-------- c:\documents and settings\All Users\Application Data\COMMON FILES 2008-11-12 18:58 . 2008-11-12 19:02 95 --a------ c:\windows\QBChanUtil_Trigger.ini 2008-11-12 18:48 . 2008-11-12 18:48 d-------- c:\program files\Akamai 2008-11-12 07:50 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 07:49 . 2008-09-04 12:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-24 14:32 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-12 23:56 --------- d-----w c:\documents and settings\Eddy\Application Data\Download Manager 2008-10-25 07:07 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-24 11:21 455,296 ------w c:\windows\system32\drivers\mrxsmb.sys 2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll 2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-15 06:23 --------- d-----w c:\program files\Common Files\LogiShrd 2008-10-15 06:22 --------- d-----w c:\program files\Logitech 2008-10-15 06:22 --------- d-----w c:\documents and settings\All Users\Application Data\Logitech 2008-10-15 06:22 --------- d-----w c:\documents and settings\All Users\Application Data\Logishrd 2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-28 01:02 --------- d-----w c:\documents and settings\Eddy\Application Data\AdobeUM 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-07-31 16:44 128,352 ----a-w c:\documents and settings\Eddy\Application Data\GDIPFONTCACHEV1.DAT 2008-05-21 02:54 168 --sh--r c:\windows\system32\31E1D33AC2.sys 2008-05-21 02:54 2,516 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded] @="{4433A54A-1AC8-432F-90FC-85F045CF383C}" [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}] 2008-02-26 03:34 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending] @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}" [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}] 2008-02-26 03:34 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected] @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}" [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}] 2008-02-26 03:34 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-08-07 700416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="Alaunch" [X] "Acer Empowering Technology Monitor"="c:\windows\system32\SysMonitor.exe" [2006-04-18 49152] "eLockMonitor"="c:\acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe" [2006-03-31 16384] "AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2007-05-22 1459992] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952] "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032] "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-09 68640] "LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256] "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 413696] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 49152] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-23 413696] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2007-10-25 1410304] "LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 2178832] "LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984] "Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-09-09 623880] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 51048] "TP CfgWiz"="c:\program files\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SymCuw.exe" [2008-02-23 611712] "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512] "RTHDCPL"="RTHDCPL.EXE" [2007-07-05 c:\windows\RTHDCPL.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-09-12 45056] Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-09-11 984352] Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"= "c:\\Documents and Settings\\Any User\\Application Data\\MySpace\\IM\\bin\\MySpaceIM.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9999:UDP"= 9999:UDP:LANScope UDP Port "2804:TCP"= 2804:TCP:LANScope TCP Port R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2007-10-25 30728] R1 OsaFsLoc;OsaFsLoc;\??\c:\windows\system32\drivers\OsaFsLoc.sys [2007-08-27 26768] R2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys [2006-06-08 17664] R2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys [2006-06-06 90112] R2 netlimiter;netlimiter;\??\c:\windows\system32\drivers\netlimiter.sys [2006-10-03 18072] R2 netlock;netlock;\??\c:\windows\system32\drivers\netlock.sys [2007-05-30 14616] R2 osaio;osaio;\??\c:\windows\system32\drivers\osaio.sys [2007-06-12 15640] R2 osanbm;osanbm;\??\c:\windows\system32\drivers\osanbm.sys [2006-11-08 10944] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ed7b28c-8287-11dd-8cea-001c25580317}] \Shell\Auto\command - boot.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe *Newly Created Service* - COMHOST *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder 2008-11-25 c:\windows\Tasks\User_Feed_Synchronization-{01C783EA-846F-4968-9952-475679F24579}.job - c:\windows\system32\msfeedssync.exe [2007-08-13 17:36] . - - - - ORPHANS REMOVED - - - - HKLM-Run-eDataSecurity Loader - c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe HKLM-Run-installnet.exe - c:\acer\LANScope Agent\Installnet.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.americangreetings.com/ uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: Open with WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll c:\windows\Downloaded Program Files\Manager.exe - c:\windows\Downloaded Program Files\DownloadManagerV2.ocx O16 -: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab c:\windows\Downloaded Program Files\DownloadManagerV2.inf . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-24 20:23:22 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(984) c:\windows\system32\Ati2evxx.dll c:\windows\system32\WgaLogon.dll - - - - - - - > 'winlogon.exe'(5184) c:\windows\system32\Ati2evxx.dll c:\windows\system32\WgaLogon.dll . Completion time: 2008-11-24 20:24:04 ComboFix-quarantined-files.txt 2008-11-25 01:24:00 Pre-Run: 44,434,866,176 bytes free Post-Run: 45,737,836,544 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 218 --- E O F --- 2008-11-21 04:47:18